E01/EWF and DD/raw
Reads EnCase E01/EWF images (decompressing chunks) and raw dd images, with a pure-Rust engine and no native libraries.
Analysis
Forensic image
The Forensic image module opens disk and media images in E01/EWF (multi-segment) and DD/raw format, recomputes the logical stream hash and compares it with the stored acquisition hash and/or an expected one: it is the proof that the acquisition is intact.
What it does
What the Forensic image module does
Acquisition integrity
Recomputes MD5/SHA-1 of the logical stream and compares them with the hashes stored in the E01 (hash/digest sections): a single tampered byte is detected.
Chain of custody
Optional comparison against an expected hash (from the report or acquisition log) to close the chain of custody.
Metadata and bad sectors
Extracts case, examiner, description, dates, acquisition software and the number of bad sectors (error2).
Step by step
How it works
- Load the image E01/EWF (also multi-segment) or DD/raw.
- Optionally paste the expected hash from the report for the chain of custody.
- Start the verification: Probatio recomputes the hash and shows the verdict and metadata.
FAQ
Frequently asked questions
Which forensic image formats does Probatio open?
EnCase E01/EWF (also multi-segment, with compressed chunks) and DD/raw images (dd, img), with a pure-Rust engine and no native libraries.
How does it verify acquisition integrity?
It recomputes MD5/SHA-1 of the logical stream and compares them with the hashes stored in the E01; you can also paste an expected hash from the report. A single tampered byte is detected.
Are the results reliable?
Yes: the hashes match those of
ewfverify (libewf), the reference tool; the verification has been validated on real images.
Related modules